Andy, thanks... I suspected as such bc I couldn't imagine how it would get to SQL. I think the long and short of it is there's no easy way to to check all users with one script or process... Unless you can query a mailbox for IPM.EnterpriseVault.Filter.* or something like that. I'm not sure how that would really tell me what I want to know.

I think I'll go with the reactive approach and if somone has an issue, I'll look at it then.

I'll leave this open a little longer before marking your response as a solution to see if somone has same "magic dust"